We are running Splunk v7.2.1 on-premise with F5 LTM v11.5.4. We are seeing some F5 events in splunk (source=bigip.snmptrap and source=bigip.syslog) but we suspect that we are missing a great deal more. The following is logged in the F5:/var/log/ltm:
Dec 18 04:20:19 slot1/my-f5-ltm err scriptd[8262]: 014f0013:3: Script (/Common/analytics-iapp_splunk-send_stats1) generated this Tcl error: (script did not successfully complete: (can't read "splunkdestinationip_withrd": no such variable while executing "string compare "$splunkdestinationip_withrd" "0" " ("Splunk" arm line 5) invoked from within "switch -- $format { "Splunk" - "F5 Analytics" { catch {exec /bin/gzip $filename$i$ext -f} ..." ("for" body line 4) invoked from within "for {set i 0} {$i <= $currentfile} {incr i} { set curl_response "fail" set ext "" switch -- $format { ..." line:2619))
Dec 18 04:20:19 slot1/my-f5-ltm err mcpd[8429]: 0107167d:3: Data publisher not found or not implemented when processing request (unknown request), tag (2901).
We do have the correct IP and port listed in "Analytics System Configuration" section and we are seeing some F5 events. Any idea how to fix these errors?
